If somebody socially engineers the account and convinces the customer service agent and changes the PIN for their own purposes, a text will be sent back to the customer phone, so the customer, who obviously isn't the party that's blagging the account, would be notified.